Web SecuritySillabus

Fənn kodu

IF-2205y-EN

Kredit

5

Tələbənin iş yükü

90

Semestr

Yaz semestri

Akademik il

—

Fənnin tipi

Məcburi

Təhsil forması

Əyani

Tədris dili

İngilis

Auditoriyadaxili saatlar

Lectures: 30 hours; Laboratory work: 30 hours

Auditoriyadan kənar saatlar

Student independent work: 60 hours; Project work / consultation hours: 30 hours

The course “Web Security” introduces the fundamental principles, methods, and technologies used to secure web applications and web services. It covers web application architecture, HTTP/HTTPS protocols, authentication and authorization mechanisms, session management, access control, and protection of user data. Students examine common web application vulnerabilities, including SQL injection, cross-site scripting (XSS), cross-site request forgery (CSRF), access control vulnerabilities, and other threats, as well as methods for their identification, analysis, and prevention. Particular attention is given to secure web application development, server-side and client-side protection, encryption mechanisms, secure configuration, and security testing of web systems.

• mühazirə
• seminar

1. 1

   CLO 1: Explain the principles of web browser operation and the fundamental principles of designing, developing, and operating web applications.

2. 2

   CLO 2: Develop secure web pages using modern technologies and demonstrate knowledge of HTML, CSS, and JavaScript.

3. 3

   CLO 3: Explain the principles of the HTTP protocol and understand the purpose and operation of SSL/TLS certificates and their role in securing web pages and communications.

4. 4

   CLO 4: Describe the nature and main types of attacks targeting websites and web applications.

5. 5

   CLO 5: Explain the principles of web services and APIs, including REST and GraphQL.

6. 6

   CLO 6: Identify common vulnerabilities presented in the OWASP Top 10 and apply appropriate mechanisms and security practices to prevent and mitigate them.

1. 1.
   Introduction to Web Security and Browser ArchitectureMühazirə

   This topic introduces the fundamental concepts and objectives of web security and provides an overview of modern web application architecture. It examines the components and operation of web browsers, including the rendering engine, JavaScript execution environment, browser storage, and security mechanisms. Particular attention is given to the interaction between browsers, web servers, and web applications and to the main security risks associated with web technologies.

2. 2.
   Information Gathering on Web SystemsMühazirə

   This topic introduces information-gathering and reconnaissance techniques used to understand the structure and security posture of web systems. It covers passive and active information gathering, domain and subdomain discovery, technology identification, web server enumeration, and analysis of publicly available information. Emphasis is placed on conducting reconnaissance in authorized and controlled environments.

3. 3.
   HTTP ProtocolMühazirə

   This topic examines the structure, operation, and security characteristics of the HTTP protocol. It covers HTTP requests and responses, methods, headers, status codes, parameters, cookies, and content types. Students will analyze how web browsers and servers communicate and examine common security risks associated with insecure HTTP configurations and improper request handling.

4. 4.
   DNS Architecture and DNS AttacksMühazirə

   This topic introduces the architecture and operation of the Domain Name System (DNS) and its role in web services. It covers DNS records, resolution processes, authoritative and recursive servers, and DNS-related security mechanisms. Students will examine common DNS attacks and vulnerabilities, including DNS spoofing, cache poisoning, and domain-related attacks, as well as basic defensive measures.

5. 5.
   Cookies and SessionsMühazirə

   This topic examines the role of cookies and session management in web applications. It covers session identifiers, cookie attributes, session creation and termination, authentication state management, and secure session handling. Particular attention is given to security attributes such as Secure, HttpOnly, and SameSite and their role in reducing session-related risks.

6. 6.
   Session Attacks and CSRF (Cross-Site Request Forgery)Mühazirə

   This topic examines common attacks targeting web sessions and authentication states, with particular emphasis on Cross-Site Request Forgery (CSRF). It explains how attackers can exploit improperly protected state-changing requests and examines the security implications of weak session management. Students will study defensive mechanisms such as anti-CSRF tokens, SameSite cookies, origin validation, and appropriate request protection.

7. 7.
   XSS Attacks and XSS ProtectionMühazirə

   This topic introduces Cross-Site Scripting (XSS) as a major web application vulnerability. It examines reflected, stored, and DOM-based XSS and explains how malicious scripts can affect users and web applications. The topic also covers defensive techniques such as output encoding, input validation, Content Security Policy (CSP), secure DOM manipulation, and appropriate handling of untrusted data

8. 8.
   Remote Code Execution (RCE)Mühazirə

   This topic introduces Remote Code Execution (RCE) vulnerabilities and examines how insecure application functionality or server configurations can potentially allow unauthorized code execution. It covers common causes of RCE, including insecure input handling, vulnerable components, and unsafe command execution. Emphasis is placed on vulnerability identification, risk assessment, secure coding, input validation, least privilege, and appropriate mitigation measures.

9. 9.
   Server SecurityMühazirə

   This topic examines the principles and practices of securing web servers and server-side components. It covers secure server configuration, access control, patch management, service minimization, logging and monitoring, file and directory permissions, and protection against unauthorized access. Students will examine common server-side security weaknesses and appropriate hardening techniques.

10. 10.
    HTTPS and HPKP (HTTP Public Key Pinning)Mühazirə

    This topic examines HTTPS and the role of TLS in protecting web communications. It covers encryption, authentication, certificates, certificate authorities, TLS handshakes, and secure configuration principles. The topic also introduces HTTP Public Key Pinning (HPKP), its historical purpose, limitations, and security considerations, including why modern web security practices generally favor alternative mechanisms such as Certificate Transparency and robust TLS configuration.

11. 11.
    Identification and AuthenticationMühazirə

    This topic introduces the concepts of identification, authentication, and authorization in web applications. It examines authentication factors, password-based authentication, multi-factor authentication, credential management, account recovery, and common authentication weaknesses. Students will study secure authentication practices and mechanisms for protecting user identities and accounts.

12. 12.
    API Authentication MethodsMühazirə

    This topic examines authentication and authorization mechanisms used to protect web APIs. It covers API keys, session-based authentication, token-based authentication, JSON Web Tokens (JWT), OAuth 2.0, and related security considerations. Students will examine secure API access control, token management, authentication flows, and common API security risks.

13. 13.
    Attacks on Large Language Models (LLMs)Mühazirə

    This topic introduces emerging security threats targeting Large Language Models (LLMs) and AI-powered web applications. It covers prompt injection, indirect prompt injection, data leakage, insecure output handling, model manipulation, and other relevant attack scenarios. The topic also examines defensive approaches for protecting AI-enabled applications, including input and output validation, access control, isolation, monitoring, and secure system design.

14. 14.
    OWASP Penetration Testing MethodologyMühazirə

    This topic introduces the OWASP approach to web application security testing and penetration testing. It covers the main stages of security testing, including reconnaissance, configuration and deployment testing, identity and authentication testing, authorization testing, input validation, session management, and other areas defined by established web security testing methodologies. Students will learn how to conduct structured and authorized security assessments and document identified vulnerabilities.

15. 15.
    Final DiscussionMühazirə

    This topic provides an integrated review of the main concepts covered throughout the course. Students will discuss web application architecture, common vulnerabilities, authentication and session security, secure communication, API security, server protection, and web security testing methodologies. The final discussion emphasizes connecting theoretical concepts with practical security scenarios and identifying appropriate prevention and mitigation strategies.

1. Hoffman, A. Web Application Security: Exploitation and Countermeasures for Modern Web Applications. O’Reilly Media, 2020.
2. Elie Saad, Rick Mitchell. OWASP Web Security Testing Guide, Version 4.2. 2020.
3. PortSwigger Web Security Academy – Learning Paths
4. OWASP Web Security Testing Guide
5. Pinto, Marcus, and Stuttard, Dafydd. The Web Application Hacker’s Handbook: Finding and Exploiting Security Flaws. Wiley, United Kingdom, 2011.